A real incident from the finance app I build solo. The security design was textbook. That's exactly why it bit me. The textbook setup Short-lived access token, long-lived rotating refresh token. Every time the client refreshes: It presents its refresh token. The server verifies it, revokes it , and issues a brand-new access + refresh pair. The old refresh token is now dead — single use. And the part everyone recommends (OWASP calls it refresh-token reuse detec...